# How to get ES aggregation data as Logstash input?

**URL:** <https://discuss.elastic.co/t/how-to-get-es-aggregation-data-as-logstash-input/64776>\
**Category:** Logstash\
**Created:** [November 2, 2016, 10:18pm UTC](https://discuss.elastic.co/t/how-to-get-es-aggregation-data-as-logstash-input/64776 "2016-11-02T22:18:00Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![KIVagant](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kivagant/32/7182_2.png) [@KIVagant](https://discuss.elastic.co/u/KIVagant)\
**Post date:** [November 4, 2016, 5:24pm UTC](https://discuss.elastic.co/t/how-to-get-es-aggregation-data-as-logstash-input/64776/2 "2016-11-04T17:24:21Z")

</div>

My trick:

1. I wrote the php-utility that made multiple queries to ES with different console arguments tuning.
2. In logstash I used the ['exec' input plugin](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-exec.html)

If someone interesting:

> **Utility response example (new line separated)**
>
> ```
> {"id":1478231999,"created_at":"2016-11-03T23:59:59.000Z","one-chart-complex-value":17,"another-chart-value":3,"something-else-calculated":4}
> {"id":1478145599,"created_at":"2016-11-02T23:59:59.000Z","one-chart-complex-value":14,"another-chart-value":2,"something-else-calculated":5}
> 
> ```

> **Logstash exec plugin config**
>
> input {  
> exec {  
> command =\> '/etc/logstash/php/daily\_chart 5'  
> interval =\> 14400  
> type =\> 'daily\_chart'  
> codec =\> multiline {  
> pattern =\> "^\n"  
> what =\> "previous"  
> }  
> }  
> }  
> filter {  
> if [type] == "daily\_chart" {  
> json {  
> source =\> "message"  
> }  
> mutate  
> {  
> convert =\> ["created\_at", "string"]  
> remove\_field =\> ["command", "message", "host"]  
> }  
> date {  
> match =\> ["created\_at", "ISO8601"]  
> target =\> ["@timestamp"]  
> }  
> }  
> }  
> output {  
> if [type] == "daily\_chart" {  
> elasticsearch {  
> # common ES output  
> }  
> }  
> }

---

_[View the full topic](https://discuss.elastic.co/t/how-to-get-es-aggregation-data-as-logstash-input/64776)._